CVE-2025-22927

The student information management system OS4ED openSIS (versions v8.0 through v9.1 ) is vulnerable to a directory traversal issue. An attacker can execute this by sending a crafted POST request to the /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename endpoint. This vulnerability pot...

CVE-2025-22928

OS4ED openSIS versions v7.0 through v9.1 are vulnerable to a SQL injection vulnerability located in the Inbox module . The flaw originates from the cp_id parameter at the /modules/messages/Inbox.php API endpoint. This vulnerability could allow an attacker to execute unauthorized SQL commands. As ...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...